The vulnerability resides in the Snort 3 Visual Basic for Applications (VBA) decompression routine, where the system fails to perform adequate error checking. This flaw can be exploited by sending a specially crafted VBA payload to the Snort 3 Detection Engine, causing it to crash and trigger a restart. The resulting denial of service disables the host’s intrusion detection capability without requiring authentication, representing a moderate risk of service denial (CVSS 5.8).

Cisco Secure Firewall Threat Defense, Cisco UTD SNORT IPS Engine, and Cisco Cyber Vision are affected. The advisory does not list specific firmware or software versions; users should consult the referenced Cisco advisory for precise guidance on which releases are impacted.

The exploit is carried out remotely from an unauthenticated attacker who crafts VBA data and delivers it to the targeted device. The EPSS score is less than 1%, indicating a low probability of active exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Despite the moderate CVSS rating, the low exploit likelihood coupled with the critical role of Snort 3 in threat detection suggests that the risk is moderate but should not be ignored, particularly in high‑visibility or regulated environments.